Re: [PATCH] audit: use copied skb length in kauditd_send_multicast_skb()

[Ricardo Robaina]

On Mon, Aug 10, 2026 at 10:32 AM Bradley Morgan <include@xxxxxxxxx> wrote:
>
> Hi Ricardo,
>
> > -     nlh->nlmsg_len = skb->len;
> > +     nlh->nlmsg_len = copy->len;
>
> Fine. skb_copy() does skb_put(n, skb->len) and nothing touches
> copy->len in between, so the two are always identical.
> Which is also why "safer" is a bit of a stretch, it prevents nothing.
> Feel free to bikeshed the changelog wording on that.
>

Thanks for reviewing this patch, Bradley. I agree with you on the wording.

> If you ever want a more interesting cleanup here, the real quirk is
> the line above: the unicast path sets nlmsg_len to skb->len minus
> NLMSG_HDRLEN, this one uses the full length.

That's interesting, maybe moving the nlmsg_len fixup out of
__audit_log_end() would be better. I'll look into it.

>
> Well, why not, please add:
>
> Reviewed-by: Bradley Morgan <include@xxxxxxxxx>
> Thanks!
>

-Ricardo